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All, 

I wanted to quickly follow-up on the denial-of-service (DoS) incident experienced by sPower, a 
company that owns and operators solar and wind generation assets in several states, that we noted 
this morning. I spoke with the operations manager of sPower this morning and the E-ISAC has also 
been in contact with the company. 

On March 5, sPower noted a series of brief communication outages between their control center 
and their remote sites. Upon further investigation, the communications outages were determined to 
have been caused by firewall reboots. After consulting with Cisco, the firewall manufacture, it was 
determined that the firewall reboots were caused by a DoS attack exploding a known vulnerability. 
Cisco recommended a firmware update, which sPower has been deploying across their system, after 
testing for compatibility. The DoS incdent was observed intermittently over a 12 hour period and no 
further activity has been observed since this time. sPower has reviewed log files and has found no 
evidence of a breach beyond the DoS attack. Additionally, the incident did not have any impacts on 
operations. 

When 1 spoke with sPower they did not expect to need any additional support or have any ongoing 
concerns; however, they will contact us if there are any issues, (b) (7)(E) 


We have been providing DOE's Office of Intelligence and 
Counterintelligence with updates and they are ready to investigate any indicators, as appropriate, 
and have been checking for any related incidents. We will work with IN and the ISACs to provide 
appropriate information to the sector as available. 

Please let me know if you have any questions. 

Best Regards, 

-Matt 

Matthew T. Tarduogno 

Infrastructure Security & Energy Restoration 

Office of Cybersecurity, Energy Security, & Emergency Response 

U.S. Department of Energy 

Office: 202-586-2892 | Mobile: (b) (6) 

Matthew.Tarduogno@hq.doe.gov 
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